Analyzing the Accessibility of GitHub Repositories for PyPI and NPM Libraries

2024-04-26

International Conference on Evaluation & Assessment in Software Engineering

AI Summary

This study addresses the observability challenge in maintaining critical libraries within open-source ecosystems by systematically assessing the accessibility of GitHub repository URLs associated with PyPI and npm packages. We propose a dual-perspective analytical framework integrating direct dependency relationships with PageRank-based importance scoring, enabling the first quantitative assessment of repository URL coverage and failure cause distributions across both ecosystems. Key findings include: (1) counterintuitively, higher-importance packages exhibit greater URL accessibility; (2) per-package URL accessibility rates are 73.8% (PyPI) and 69.4% (npm), improving to 80.1% and 81.1%, respectively, when considering transitive dependency chains; and (3) “missing repository URL configuration” is the predominant failure cause—accounting for 17.9% of PyPI and 39.6% of npm cases. These results provide empirical foundations and methodological support for enhancing supply-chain security monitoring in open-source software.

Technology Category

• Knowledge Representation and Reasoning: Computational Complexity of Reasoning
• Data Mining & Knowledge Management: Representing, Reasoning, and Using Provenance, Trust
• Reasoning under Uncertainty: Causality

Application Category

• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Web Mining and Content Analysis: Web data provenance, reliability, and authenticity
• Security and Privacy: Data transparency and provenance

Abstract

Industrial applications heavily rely on open-source software (OSS) libraries, which provide various benefits. But, they can also present a substantial risk if a vulnerability or attack arises and the community fails to promptly address the issue and release a fix due to inactivity. To be able to monitor the activities of such communities, a comprehensive list of repositories for the libraries of an ecosystem must be accessible. Based on these repositories, integrated libraries of an application can be monitored to observe whether they are adequately maintained. In this descriptive study, we analyze the accessibility of GitHub repositories for PyPI and NPM libraries. For all available libraries, we extract assigned repository URLs, direct dependencies and use the page rank algorithm to comprehensively analyze the ecosystems from a library and dependency chain perspective. For invalid repository URLs, we derive potential reasons. Both ecosystems show varying accessibility to GitHub repository URLs, depending on the page rank score of the analyzed libraries. For individual libraries, up to 73.8% of PyPI and up to 69.4% of NPM libraries have repository URLs. Within dependency chains, up to 80.1% of PyPI libraries have URLs, while up to 81.1% for NPM. That means, most libraries, especially the ones of increasing importance, can be monitored on GitHub. Among the most common reasons for invalid repository URLs is no URLs being assigned at all, which amounts up to 17.9% for PyPI and up to 39.6% for NPM. Package maintainers should address this issue and update the repository information to enable monitoring of their libraries.

Problem

• Assessing GitHub repository accessibility for PyPI and NPM libraries
• Identifying reasons for invalid repository URLs in OSS ecosystems
• Evaluating dependency chain coverage of maintainable library repositories

Innovation

• Extract repository URLs for PyPI and NPM libraries
• Analyze ecosystems using page rank algorithm
• Identify reasons for invalid repository URLs